Weaknesses of type CWE-664

64 results

Controle inadequado de recurso durante seu ciclo de vida

Ocorre quando o software não gerencia corretamente a alocação, uso e liberação de um recurso (memória, arquivo, conexão de banco de dados, handle). Isso permite que o recurso seja acessado após ser liberado, reutilizado de forma insegura, ou nunca liberado, causando vazamentos ou corrupção de estado.

Example

Uma aplicação web abre uma conexão com banco de dados em uma thread, mas não a fecha em caso de exceção. A conexão fica aberta indefinidamente, exaurindo o pool de conexões. Ou um buffer é liberado, mas o código continua escrevendo nele em outra parte da aplicação, causando corrupção de memória.

How to mitigate

Use padrões como try-finally, try-with-resources (Java) ou context managers (Python) para garantir liberação automática. Implemente análise estática para detectar vazamentos. Revise o fluxo de controle (exceções, retornos antecipados) e documente claramente quem é responsável por liberar cada recurso.

CVE-2026-18549HIGH@fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limitEPSS 0.6%CVE-2022-28287MEDIUMIn unusual circumstances, selecting text could cause text selection caching to behave incorrectly, leading to a crash. This vulnerability afEPSS 0.6%CVE-2026-20274CRITICALCisco IOS XR Software Security Hardening Release: September 2026EPSS 0.5%CVE-2026-20353CRITICALCisco Secure Email Gateway Security Hardening ReleaseEPSS 0.5%CVE-2026-54251HIGHnetty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of ServiceEPSS 0.5%CVE-2026-8517HIGHObject lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage EPSS 0.5%CVE-2022-22249MEDIUMJunos OS: MX Series: An FPC crash might be seen due to mac-moves within the same bridge domainEPSS 0.5%CVE-2026-57187HIGHAsterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processingEPSS 0.5%CVE-2024-37139MEDIUMDell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an Improper Control of a Resource Through itsEPSS 0.5%CVE-2026-43158HIGHxfs: fix freemap adjustments when adding xattrs to leaf blocksEPSS 0.5%CVE-2026-20158HIGHCisco RoomOS Security Hardening Release - Resource Lifetime Management VulnerabilitiesEPSS 0.5%CVE-2026-20269HIGHCisco IOS XE Software Security Hardening ReleaseEPSS 0.5%CVE-2026-102026HIGHJunos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP RIB sharding is usedEPSS 0.5%CVE-2024-22365MEDIUMlinux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat cEPSS 0.5%CVE-2026-68908MEDIUMlibIEC61850: Oversized RptID can trigger invalid free of a stack-backed visible string in the report send pathEPSS 0.5%CVE-2026-57446MEDIUMlibIEC61850: Server-side double free in MMS ObtainFile task reuse due to stale FILE* handleEPSS 0.4%CVE-2026-76408CRITICALImproper Control of a Resource Through its Lifetime in Splunk SOAREPSS 0.4%CVE-2026-76282HIGHImproper Control of a Resource Through its Lifetime in Splunk EnterpriseEPSS 0.4%CVE-2023-44295MEDIUM Dell PowerScale OneFS versions 8.2.2.x through 9.6.0.x contains an improper control of a resource through its lifetime vulnerability. A lowEPSS 0.4%CVE-2026-76300HIGHSecurity Hardening in Splunk Enterprise - October 2026EPSS 0.4%